wicked-garden 12.59.0 → 12.60.0

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.59.0"}], "version": "12.59.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.60.0"}], "version": "12.60.0"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.59.0",
+  "version": "12.60.0",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": ">=0.8.0",
   "wicked_ledger_version": "^0.6.0",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.59.0",
+  "version": "12.60.0",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [
     "coding-agent",

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [12.60.0] — 2026-10-26
+
+### Fixed
+- **Per-turn hooks stop injecting on prompts they don't fit (#1333).** The prompt and Stop hooks run on every turn, on every seat that loads garden. An injection that misfires costs context and teaches agents to skim past reminders.
+  - **Context Assembly is decided per prompt.** The session intent is sticky, so once a session's first prompt read as research, every later prompt got the directive, including "agree", "still waiting" and "how is it going?". It now fires only when the prompt itself names code, files, symbols, repos or past decisions AND has more than 12 words or asks a question. Acknowledgements (including short ones such as "yes, sounds good to me"), status checks and one- or two-word replies get nothing, even when they name a file or symbol ("how is repo_checks.rs going?"). The directive no longer names the estate MCP `SearchEntity` tool (no estate MCP is registered on a seat). It points at the mem and search skills and the read-only shim instead.
+  - **Output Governance runs once per session and does the work itself.** The per-turn line ("If the estate MCP is connected: call `rules.recall`…") could never run. The first Stop of a session now calls `rules.recall {"rule_type":"policy"}` through the read-only shim. When the store holds policy rules, the hook names the count and the top three once, with the command that lists them all. The once-per-session claim is an atomic marker file, so a prompt hook saving a stale session state can't re-arm it. Zero rules, an unreachable estate or an error: silent. `WG_OUTGOV=off` still opts out.
+  - **No `classify-due` nag.** When the regex router falls through, the hook emits nothing. A medium-confidence regex match (one keyword, such as "outage" in a status question) emits nothing either. Only a high-confidence match (≥ 0.7) tags the turn.
+  - **`prove:` lines ride only a confident archetype** (score ≥ 0.7, from the regex or from a persisted model classification), never a fall-through. A persisted classification (the model's own, from `wicked-garden-classify`) is echoed back once per classification, not on every turn, and only its confident archetypes.
+- **The agent memory path is one line (#1333).**
+  - `_estate_client.py <action> -` reads its JSON from stdin. It used to parse `-` as a literal string, so `propose -` failed with a generic shape error.
+  - `propose` errors name the exact field: `missing kind_type`, `payload must be an object, got str`, `json-args is not valid JSON`; a missing `facets.project` is still reported by name.
+  - New `wicked-garden-mem` action `propose`: `wicked-garden run scripts/mem/estate_memory.py --readonly propose '<text>'` (or `propose -` with text or JSON on stdin) builds the envelope itself: `kind_type: memory`, `payload {content, tier}`, `facets {repo, project}` from the cwd's checkout (outside a checkout, `project` = the cwd name; default `recall` now sends that same intent, so the approved memory is recalled from where it was proposed). It applies the same durability refusals as `store`. It is the write a read-only seat still has, and the memory lands pending until an operator approves it.
+  - The hook that blocks writes to `MEMORY.md` and the native memory directory now prints that exact command.
+
+
 ## [12.59.0] — 2026-10-25
 
 ### Added
@@ -1197,7 +1212,8 @@ through `v9.2.18`. Major themes across that span:
 
 For each of those releases, see the corresponding tag in git history.
 
-[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...HEAD
+[Unreleased]: https://github.com/mikeparcewski/wicked-garden/compare/v12.60.0...HEAD
+[12.60.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.59.0...v12.60.0
 [12.59.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.58.0...v12.59.0
 [12.58.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.57.0...v12.58.0
 [12.57.0]: https://github.com/mikeparcewski/wicked-garden/compare/v12.56.0...v12.57.0

package/docs/README.md

@@ -14,7 +14,7 @@ Work in wicked-garden is organized around **10 work-shape archetypes** — not a
 | [Required Peers](required-peers.md) | The one required peer (plus the opt-in layers) and the install/runtime stance |
 | [The Compiler](compiler.md) | `/wicked-garden-prove compile` — emit a self-contained vault-backed gate into any repo |
 | [Extending the Catalog](extending.md) | Ship a third-party pack — `{vendor}-{domain}-{role}` skills, the `wicked-pack.json` manifest, the shipped conformance gate, install + crew routing |
-| [Output Governance (Per-Turn)](outgov-per-turn.md) | The advisory hook lane — `WG_OUTGOV` modes (default `warn`), `rules.recall` as the single per-turn rule source, content-hash provenance for the graph-derived rules dir |
+| [Output Governance (hook-side)](outgov-per-turn.md) | The advisory hook lane — `WG_OUTGOV` modes (default `warn`), a once-per-session `rules.recall` audit through the read-only shim, content-hash provenance for the graph-derived rules dir |
 | [Brain Chunk Format](brain-chunk-format.md) | Historical: how content was chunked for the retired wicked-brain index (the migrated chunks in wicked-estate keep this shape) | <!-- historical -->
 
 ## Quick Links

package/docs/outgov-per-turn.md

@@ -1,4 +1,4 @@
-# Output Governance — the Per-Turn Advisory Lane
+# Output Governance — the Hook-Side Advisory Lane
 
 How the interactive (hook-side) half of output governance works after AW-16
 (arch-R14): **one source of per-turn truth, default-on advisory, fail-open by
@@ -10,7 +10,7 @@ Enforcement in the wicked platform is two-tier (TARGET-ARCHITECTURE contract 3):
 
 | Tier | Where | Behavior |
 |------|-------|----------|
-| **Advisory** | garden hooks (`stop.py` per-turn advisory, `guard_pipeline` Check 6) | fail-open — surfaces findings, never blocks |
+| **Advisory** | garden hooks (`stop.py` session audit, `guard_pipeline` Check 6) | fail-open — surfaces findings, never blocks |
 | **Enforcing** | crew/core gates (`output-gate-hook`, acceptance gate) | fail-closed — deny dominates |
 
 There is **no third tier**. `WG_OUTGOV=strict` only strengthens the advisory's
@@ -23,11 +23,16 @@ enforced belongs in the crew/core gates, not here.
 Both hook-side consumers read the **estate graph** — never an independent
 rulebook:
 
-1. **Per-turn advisory** (`hooks/scripts/stop.py::_check_outgov_compliance`):
-   the Stop-hook systemMessage directs the model at the estate MCP tool
-   **`rules.recall`** (`{"rule_type": "policy"}`, severity-ordered,
-   graph-backed) — the wire twin of wicked-governance's `recall_rules`. If
-   estate or the tool is unavailable, the advisory says to skip silently.
+1. **Session audit** (`hooks/scripts/stop.py::_check_outgov_compliance`):
+   on the FIRST Stop of a session the hook itself runs **`rules.recall`**
+   (`{"rule_type": "policy"}`, severity-ordered, graph-backed, the wire twin
+   of wicked-governance's `recall_rules`) through the read-only shim
+   (`scripts/_estate_client.py --readonly call`). When the store holds policy
+   rules it names the count and the top three once, with the command that
+   lists them all. Zero rules, an unreachable estate or any error: silent.
+   It used to be a per-turn line telling the model to call the tool "if the
+   estate MCP is connected", which no seat ever is (by design), so it could
+   never run (garden#1333).
 
 2. **Session-close pattern check**
    (`scripts/platform/guard_pipeline.py::check_outgov_pattern`, Check 6):
@@ -39,13 +44,15 @@ rulebook:
 
 ## `WG_OUTGOV` modes and the default
 
-| Value | Per-turn advisory (stop.py) | Check 6 (guard_pipeline) |
-|-------|------------------------------|---------------------------|
-| *(unset)* → **`warn`** | fires (default-on advisory) | runs |
-| `warn` | fires | runs |
-| `strict` | fires with stronger wording — still advisory | runs |
+| Value | Session audit (stop.py) | Check 6 (guard_pipeline) |
+|-------|-------------------------|---------------------------|
+| *(unset)* → **`warn`** | runs once per session (default-on advisory) | runs |
+| `warn` | runs once per session | runs |
+| `strict` | runs once, stronger wording — still advisory | runs |
 | `off` (or any other value) | silent | skips |
 
+The audit is also silent when `WICKED_CONTEXT_BACKEND=off`.
+
 **The default flipped from `off` to `warn` in AW-16**, after the seed corpus
 (AW-13) gave the advisory real rules to recall. Every mode is fail-open: a
 missing estate, a missing rules dir, or a broken bundle can only *reduce*
@@ -63,7 +70,8 @@ The flip is **default-on in code, per-repo in practice**:
 - **Noise budget owner**: whoever keeps a repo opted in owns its noise budget
   (the repo maintainer by default). The advisory costs at most one
   systemMessage per Stop; Check 6 findings are capped by the guard-pipeline
-  budget and profile.
+  budget and profile. The audit costs at most one systemMessage per session,
+  and none when the store has no policy rules.
 - If recall noise is systemic (bad rules, not bad wiring), fix the corpus —
   retire or re-scope the offending rules in the graph — rather than muting the
   lane ecosystem-wide.
@@ -127,18 +135,18 @@ Hermetic tests — no live estate needed, fixture rules dirs only:
   **missing rules dir ⇒ skip with a note, zero findings, no block**; stale
   provenance ⇒ warn-severity finding only, rules still surfaced; hash
   determinism + generator/consumer recipe equality.
-- `tests/hooks/test_stop_outgov.py` — the per-turn directive names
-  `rules.recall`; default-on; `off` opts out; `strict` stays advisory; any
-  internal error returns no message.
+- `tests/hooks/test_stop_outgov.py` — the audit runs `rules.recall` once per
+  session; silent on zero rules, an unreachable estate or an error; names no
+  MCP; default-on; `off` opts out; `strict` stays advisory.
 
 ## Pointers
 
-- `hooks/scripts/stop.py` — `_check_outgov_compliance` (per-turn advisory)
+- `hooks/scripts/stop.py` — `_check_outgov_compliance` (once-per-session audit)
 - `scripts/platform/guard_pipeline.py` — Check 6 (`check_outgov_pattern`),
   `compute_rules_content_hash`, `write_rules_provenance`, the `hash` CLI
 - `skills/engineering/refs/conformance.md` — the agent-half rubric that
   evaluates Check 6's surfaced rules semantically
 - wicked-core `crates/wicked-governance` — the graph side: `rules ingest`,
   `rules fanout` (the manifest + store split), `rules.recall`'s Rust twin
-- History: garden#983 (pattern check), garden#984 (per-turn guardrail, closed),
+- History: garden#983 (pattern check), garden#984 (per-turn guardrail, closed), garden#1333 (per-turn line → session audit),
   AW-16 / arch-R14 (this document's change)

package/hooks/scripts/pre_tool.py

@@ -280,17 +280,19 @@ def _handle_write_guard(tool_input: dict) -> str:
     is_auto_memory = _AUTO_MEMORY_MARKER in file_path and "/memory/" in file_path
 
     if is_memory_md or is_auto_memory:
-        # Name the memory surface (estate memory.capture). Fail-open to the
-        # same wording.
+        # garden#1333: hand over the exact one-line command, not a skill name
+        # the agent then has to route through (and that refuses `store` on a
+        # read-only seat). Fail-open to the same literal command.
         try:
-            from _context_backend import memory_directive_target
-            _mem_target = memory_directive_target()
+            from _context_backend import MEMORY_PROPOSE_COMMAND as _mem_cmd
         except Exception:
-            _mem_target = "the wicked-garden-mem skill (store action)"
+            _mem_cmd = ("wicked-garden run scripts/mem/estate_memory.py --readonly propose "
+                        "'<the rule, why it holds, when it applies>'")
         return _deny(
-            "Do not write to MEMORY.md or the auto memory directory. "
-            "This project uses wicked-garden memory for persistence. "
-            f"Use {_mem_target} to save decisions, patterns, and gotchas instead."
+            "Do not write to MEMORY.md or the auto memory directory; this project keeps "
+            "memory in wicked-estate. Save the learning with one command instead "
+            "(it files a memory proposal for this project; pipe longer text with `propose -`):\n"
+            f"{_mem_cmd}"
         )
 
     # Issue #442: challenge-artifacts gate for build-phase writes

package/hooks/scripts/prompt_submit.py

@@ -185,51 +185,73 @@ def _with_prove_hints(directive: str, archetypes: list[str]) -> str:
         return directive
 
 
+# garden#1333: a `prove:` line is steering the agent acts on at the gate
+# phase, so it rides only a confident classification. Mirrors
+# archetypes_v11.HIGH_CONFIDENCE (kept literal so the hook needs no import
+# to decide; tests lock the two together).
+_PROVE_MIN_SCORE = 0.7
+
+
 def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | None:
     """v11 — emit a slim work-shape archetype steering directive.
 
     Two-tier classification:
 
-    1. **Persisted (LLM)**: when SessionState carries a recent
-       `classified_at` + `archetypes_v11`, prefer that — the model
-       already classified through the wicked-garden-classify skill.
-    2. **Fallback (regex)**: when no persisted classification exists,
-       run archetypes_v11.detect_archetypes() against the prompt
-       directly. If the prompt is non-trivial (intent != simple-edit)
-       AND the regex result is weak (only triage matched), emit a
-       directive asking the model to invoke the classify skill —
-       LLM reasoning beats regex on ambiguous prompts.
-
-    Skips emission when intent is 'simple-edit' (silence is the signal).
-    Fail-open on any error.
+    1. **Persisted (LLM)**: when SessionState carries `archetypes_v11` (the
+       model classified through the wicked-garden-classify skill), emit its
+       tag / shape card.
+    2. **Fallback (regex)**: archetypes_v11.detect_archetypes() on the
+       prompt. Emits only a HIGH-confidence match; a fall-through (only
+       triage) or a medium keyword hit emits nothing (garden#1333: the
+       fall-through used to ask for a model classification on every
+       ordinary question, and medium hits misrouted status questions).
+
+    Both tiers emit only archetypes scored >= _PROVE_MIN_SCORE, so a
+    `prove:` line never rides a low-confidence route; the persisted tier
+    is echoed once per classification.
+    Silent on simple-edit sessions and on chatter (acknowledgements, status
+    checks, short replies). Fail-open on any error.
     """
     if not prompt or not prompt.strip():
         return None
     if intent == "simple-edit":
         return None
+    try:
+        if _is_chatter(prompt):
+            return None
+    except Exception:
+        return None
 
     # Tier 1: persisted classification from the classify skill
     persisted = (getattr(state, "archetypes_v11", None) or []) if state else []
     if persisted:
-        # Filter triage out unless sole match; emit shape-card from persisted.
-        real = [a for a in persisted if a.get("name") != "triage"]
+        # The model classified this itself (wicked-garden-classify). Echo it
+        # back once per classification, and only its confident archetypes:
+        # repeating it on every later turn added nothing (garden#1333).
+        real = [a for a in persisted
+                if a.get("name") != "triage"
+                and float(a.get("score", 0)) >= _PROVE_MIN_SCORE][:3]
         if not real:
             return None
-        if len(real) == 1 and float(real[0].get("score", 0)) >= 0.7:
+        key = f"{getattr(state, 'classified_at', None)}|" + json.dumps(real, sort_keys=True)
+        if getattr(state, "archetype_echoed", None) == key:
+            return None
+        try:
+            state.update(archetype_echoed=key)
+        except Exception:
+            pass
+        if len(real) == 1:
             n = real[0]["name"]
             s = float(real[0]["score"])
             base = f"<wg archetype=\"{n}\" score=\"{s:.2f}\" classified=\"llm\" />"
             return _with_prove_hints(base, [n])
-        shape_lines = [
-            f"  - {a['name']} ({float(a.get('score', 0)):.2f})"
-            for a in real[:3]
-        ]
+        shape_lines = [f"  - {a['name']} ({float(a['score']):.2f})" for a in real]
         base = (
             "<wg archetypes classified=\"llm\">\n"
             + "\n".join(shape_lines)
             + "\n</wg>"
         )
-        return _with_prove_hints(base, [a["name"] for a in real[:3]])
+        return _with_prove_hints(base, [a["name"] for a in real])
 
     # Tier 2: regex fallback
     try:
@@ -240,7 +262,7 @@ def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | No
         for p in (_scripts, _crew):
             if str(p) not in _sys.path:
                 _sys.path.append(str(p))
-        from archetypes_v11 import detect_archetypes, HIGH_CONFIDENCE
+        from archetypes_v11 import detect_archetypes
     except Exception:
         return None
 
@@ -249,33 +271,25 @@ def _build_archetype_directive(prompt: str, intent: str, state=None) -> str | No
     except Exception:
         return None
 
-    real = [(n, s, e) for (n, s, e) in matches if n != "triage"]
-
-    if not real:
-        # Regex couldn't classify cleanly — ask the model to do it instead.
-        # This is the LLM-classifier opt-in path: the model invokes the
-        # wicked-garden-classify skill, persists the result, and on the
-        # next turn the persisted-tier branch above takes over.
-        return (
-            "<wg classify-due />\n"
-            "Regex classifier could not route this prompt to a v11 archetype. "
-            "Invoke the `wicked-garden-classify` skill to classify with model "
-            "reasoning, then run the chosen archetype's playbook."
-        )
-
-    high = [(n, s, e) for (n, s, e) in real if s >= HIGH_CONFIDENCE]
-    if len(high) == 1 and len(real) == 1:
-        n, s, _ = high[0]
+    high = [(n, s) for (n, s, _e) in matches
+            if n != "triage" and s >= _PROVE_MIN_SCORE]
+    if not high:
+        # Fall-through or medium-only: the regex has no confident route, so
+        # it says nothing (garden#1333). The classify skill stays available
+        # for the agent to invoke when the work shape matters.
+        return None
+    if len(high) == 1:
+        n, s = high[0]
         base = f"<wg archetype=\"{n}\" score=\"{s:.2f}\" classified=\"regex\" />"
         return _with_prove_hints(base, [n])
 
-    shape_lines = [f"  - {n} ({s:.2f})" for (n, s, _) in real[:3]]
+    shape_lines = [f"  - {n} ({s:.2f})" for (n, s) in high[:3]]
     base = (
         "<wg archetypes classified=\"regex\">\n"
         + "\n".join(shape_lines)
         + "\n</wg>"
     )
-    return _with_prove_hints(base, [n for (n, _s, _e) in real[:3]])
+    return _with_prove_hints(base, [n for (n, _s) in high[:3]])
 
 
 def _suggest_jam(prompt: str, state) -> str | None:
@@ -444,6 +458,122 @@ def _has_imperative_technical_verb(prompt_lower: str) -> bool:
     return any(verb in prompt_lower for verb in _IMPERATIVE_TECHNICAL_VERBS)
 
 
+# ---------------------------------------------------------------------------
+# garden#1333 — per-prompt grounding gate
+#
+# The session intent above is sticky: once a session's first prompt read as
+# feature/research, every later prompt ("agree", "still waiting", "how is it
+# going?") got the Context Assembly directive. That trained agents to skim
+# past it. The directive is now decided per prompt, from what the prompt
+# itself names: it fires only when the prompt names code, files, symbols,
+# repos or past decisions AND is long enough to need grounding (more than
+# _GROUNDING_MIN_WORDS words) or asks a question about them.
+# ---------------------------------------------------------------------------
+
+_GROUNDING_MIN_WORDS = 12  # "more than ~12 words" (garden#1333 item 1)
+
+# Strong code signals: the prompt points at a concrete thing in the codebase.
+_IDENTIFIER_PATTERN = re.compile(
+    r"\b[A-Za-z][A-Za-z0-9]*_[A-Za-z0-9_]+\b"      # snake_case / SCREAMING_CASE
+    r"|\b[a-z]+[A-Z][A-Za-z0-9]*\b"                # camelCase
+    r"|\b[A-Z][a-z0-9]+[A-Z][A-Za-z0-9]*\b"        # PascalCase (two humps)
+    r"|\b\w+::\w+"                                # Rust/C++ paths
+    r"|\b\w+\(\)"                                # call()
+    r"|\bwicked-[a-z][a-z0-9-]*\b"                  # a wicked-* repo
+)
+_DECISION_PATTERN = re.compile(
+    r"\b(?:why did we|what did we decide|did we decide|we decided|decision|"
+    r"adr|rationale|why do we)\b",
+    re.IGNORECASE,
+)
+# Weak code signals: code nouns. They ground only a question or a long prompt.
+_CODE_NOUN_PATTERN = re.compile(
+    r"\b(?:function|method|class|module|crate|package|codebase|repo|repository|"
+    r"hook|endpoint|schema|symbol|api|script|test|tests|struct|trait|interface|"
+    r"config|migration|query|branch|commit)s?\b",
+    re.IGNORECASE,
+)
+# Status checks and acknowledgements never need grounding.
+_STATUS_PATTERN = re.compile(
+    r"\b(?:how(?:'s| is| are)\b.*\bgoing|status|any (?:update|news|progress)|"
+    r"still (?:waiting|running|working|going)|where are we|are (?:you|we) done|"
+    r"is it done|done yet|how far|eta|progress|update me|what'?s left)\b",
+    re.IGNORECASE,
+)
+_ACKNOWLEDGEMENTS = frozenset({
+    "agree", "agreed", "yes", "ok", "okay", "sure", "yep", "yup", "go",
+    "go ahead", "do it", "continue", "proceed", "thanks", "thank you", "ty",
+    "lgtm", "looks good", "sounds good", "great", "perfect", "nice", "cool",
+    "approved", "approve", "no", "nope", "stop", "wait", "next", "done",
+    "keep going", "carry on", "makes sense", "got it", "right", "correct",
+})
+# `do` opens a question only with a subject ("do we…"), never an imperative
+# ("do not touch the config").
+_QUESTION_START = re.compile(
+    r"^\s*(?:why|how|what|where|which|who|when|does|is|are|can|could|should|"
+    r"would|will|do\s+(?:we|you|i|they|these|those|it)\b)\b",
+    re.IGNORECASE,
+)
+# A reply that opens with an acknowledgement and stays short ("yes, sounds
+# good to me", "thanks for doing that") is still an acknowledgement.
+_ACK_PREFIX = re.compile(
+    r"^\s*(?:yes|yep|yup|ok|okay|sure|thanks|thank you|ty|agreed?|i agree|"
+    r"sounds good|looks good|lgtm|great|perfect|nice|cool|go ahead|do it|"
+    r"makes sense|got it)\b",
+    re.IGNORECASE,
+)
+_ACK_PREFIX_MAX_WORDS = 8
+_SHORT_REPLY_MAX_WORDS = 2  # "go", "still waiting", "repo_checks.rs?"
+
+
+def _normalize(prompt: str) -> str:
+    return re.sub(r"[^\w\s'-]", "", prompt.strip().lower()).strip()
+
+
+def _has_strong_code_signal(prompt: str) -> bool:
+    return (
+        _has_file_path(prompt)
+        or _has_code_markers(prompt)
+        or bool(_IDENTIFIER_PATTERN.search(prompt))
+        or bool(_DECISION_PATTERN.search(prompt))
+    )
+
+
+def _is_chatter(prompt: str) -> bool:
+    """True for acknowledgements, status checks and one- or two-word replies,
+    whatever they name. No per-turn directive belongs on these."""
+    if not prompt or not prompt.strip():
+        return True
+    if _normalize(prompt) in _ACKNOWLEDGEMENTS:
+        return True
+    if _STATUS_PATTERN.search(prompt):
+        return True
+    words = len(prompt.split())
+    if words <= _SHORT_REPLY_MAX_WORDS:
+        return True
+    return (
+        words <= _ACK_PREFIX_MAX_WORDS
+        and bool(_ACK_PREFIX.match(prompt))
+        and not _has_strong_code_signal(prompt)
+    )
+
+
+def _prompt_needs_grounding(prompt: str) -> bool:
+    """garden#1333: the Context Assembly gate, decided per prompt.
+
+    True only when the prompt names code, files, symbols, repos or past
+    decisions AND either has more than _GROUNDING_MIN_WORDS words or asks a
+    question. Never on acknowledgements, status checks or one-word replies.
+    """
+    if _is_chatter(prompt):
+        return False
+    strong = _has_strong_code_signal(prompt)
+    if not strong and not _CODE_NOUN_PATTERN.search(prompt):
+        return False
+    question = "?" in prompt or bool(_QUESTION_START.match(prompt))
+    return question or len(prompt.split()) > _GROUNDING_MIN_WORDS
+
+
 # ---------------------------------------------------------------------------
 # Setup gate
 # ---------------------------------------------------------------------------
@@ -723,16 +853,15 @@ def _build_intent_directive(intent: str, turn_count: int, state=None) -> str:
         grounding = grounding_directive_lines()
     except Exception:
         grounding = [
-            "1. Ground in the knowledge layer via the wicked-garden-mem skill "
-            "(recall/answer over wicked-estate knowledge + memory) — concepts, "
-            "files, and past decisions, with source attribution; use the estate "
-            "MCP SearchEntity tool for symbol lookup.",
+            "1. Recall what is already known: the wicked-garden-mem skill "
+            "(`recall` / `answer`) for past decisions, the wicked-garden-search "
+            "skill for symbols and blast radius.",
             "2. Open the cited sources with Read before answering; do not answer "
             "from recall snippets alone.",
         ]
     directive_lines = [
-        f"[Context Assembly — intent={intent}] Deep context needed before answering.",
-        "BEFORE drafting a response:",
+        f"[Context Assembly — intent={intent}] This prompt names code or past "
+        "decisions; ground it before answering:",
         *grounding,
     ]
     if intent == "rigor":
@@ -942,9 +1071,12 @@ def main():
         # turns produce an empty directive; feature/research/rigor produce
         # the synthesis directive.
         _intent = getattr(state, "intent", None) if state else None
-        intent_directive = _build_intent_directive(
-            _intent or "simple-edit", turn_count, state
-        )
+        # garden#1333: the sticky session intent only labels the directive;
+        # whether it fires is decided by THIS prompt (_prompt_needs_grounding).
+        intent_directive = ""
+        if _prompt_needs_grounding(prompt):
+            label = _intent if _intent in ("feature", "research", "rigor") else "research"
+            intent_directive = _build_intent_directive(label, turn_count, state)
 
         # WIP recovery: surface native in-progress tasks (v5 ticket rail gone)
         wip_block = _build_wip_recovery_block(session_id, project)

package/hooks/scripts/stop.py

@@ -57,27 +57,106 @@ def _session_dir(subdir: str) -> Path:
 
 
 # ---------------------------------------------------------------------------
-# Output governance — per-turn policy compliance advisory (garden#984, AW-16)
+# Output governance — once-per-session rules audit (garden#984, AW-16, #1333)
 # ---------------------------------------------------------------------------
 #
-# When WG_OUTGOV=warn|strict, returns a systemMessage asking Claude to recall
-# applicable conformance rules from the estate graph via `rules.recall` — THE
-# single per-turn rule source (arch-R14) — and evaluate this turn's output.
+# The per-turn line ("If the estate MCP is connected: call rules.recall…") is
+# gone: no estate MCP is registered on a seat by design, so it was an
+# instruction that could never run, repeated every turn (garden#1333). In its
+# place, the FIRST Stop of a session runs `rules.recall` itself through the
+# read-only shim (the one way to estate on every seat) and, only when the store
+# holds policy rules, names them once with the command that lists them all.
+# Zero rules, an unreachable estate, or any error: silent.
 #
-# Default is `warn` (default-on advisory, AW-16 after the AW-13 seed corpus).
-# Set WG_OUTGOV=off to opt a repo out (P-5 per-repo noise-budget escape hatch;
-# see docs/outgov-per-turn.md). Any unrecognized value is treated as off.
-#
-# Two-tier doctrine (TARGET-ARCHITECTURE contract 3): this hook is fail-open
-# ADVISORY — it never blocks, even at `strict` (strict only strengthens the
-# wording). Fail-closed enforcement lives in the crew/core gates, never here.
+# WG_OUTGOV=warn (default) | strict | off (per-repo opt-out, P-5). Any
+# unrecognized value is treated as off. Two-tier doctrine (TARGET-ARCHITECTURE
+# contract 3): fail-open ADVISORY at every mode; `strict` only strengthens the
+# wording. Fail-closed enforcement lives in the crew/core gates, never here.
+
+_OUTGOV_RULES_ARGS = {"rule_type": "policy", "limit": 5}
+_OUTGOV_LIST_CMD = (
+    "wicked-garden run scripts/_estate_client.py --readonly call "
+    '\'{"tool":"rules.recall","arguments":{"rule_type":"policy"}}\''
+)
+
+
+def _recall_policy_rules(timeout: float = 15.0) -> Optional[dict]:
+    """`rules.recall {"rule_type":"policy"}` through the read-only shim.
+
+    Returns the tool's result (`{"rules": [...], "total": N, ...}`) or None on
+    any failure (shim missing, estate unreachable, timeout, bad JSON).
+    """
+    try:
+        import subprocess
+        shim = _PLUGIN_ROOT / "scripts" / "_estate_client.py"
+        if not shim.is_file():
+            return None
+        req = json.dumps({"tool": "rules.recall", "arguments": _OUTGOV_RULES_ARGS,
+                          "all_pages": False})
+        proc = subprocess.run(
+            [sys.executable, str(shim), "--readonly", "call", req],
+            capture_output=True, text=True, timeout=timeout,
+        )
+        if proc.returncode != 0:
+            return None
+        out = json.loads((proc.stdout or "").strip().splitlines()[-1])
+        result = out.get("result") if isinstance(out, dict) else None
+        return result if isinstance(result, dict) else None
+    except Exception:
+        return None
 
-def _check_outgov_compliance(_input_data: dict) -> list:
-    """Per-turn policy compliance advisory unless WG_OUTGOV is off."""
+
+def _claim_outgov_audit(input_data: dict) -> bool:
+    """Atomically claim this session's one audit. True exactly once per session.
+
+    An O_EXCL marker file, not a SessionState flag: Stop runs async, and a
+    prompt hook that loaded the state before Stop saved the flag would write
+    the old value back on its own save, re-arming the audit. Two concurrent
+    Stops can't both create the file either.
+    """
+    raw = str(input_data.get("session_id") or os.environ.get("CLAUDE_SESSION_ID") or "default")
+    sid = "".join(c if c.isalnum() or c in "-_" else "_" for c in raw)[:128] or "default"
+    marker_dir = Path(os.environ.get("TMPDIR") or __import__("tempfile").gettempdir()) / "wicked-garden-outgov"
+    marker_dir.mkdir(parents=True, exist_ok=True)
+    try:
+        fd = os.open(str(marker_dir / f"{sid}.audited"), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+    except FileExistsError:
+        return False
+    os.close(fd)
+    return True
+
+
+def _check_outgov_compliance(input_data: dict, recall=None, claim=None) -> list:
+    """Once-per-session policy-rules audit unless WG_OUTGOV is off.
+
+    `recall` / `claim` are test seams (default: the shim, the marker file).
+    """
     try:
         mode = os.environ.get("WG_OUTGOV", "warn").strip().lower()
         if mode not in ("warn", "strict"):
             return []
+        if os.environ.get("WICKED_CONTEXT_BACKEND", "").strip().lower() == "off":
+            return []  # operator turned estate-backed context off: designed silence
+        # Claim BEFORE the call: a slow or failing estate costs one attempt per
+        # session, never one per turn.
+        if not (claim or _claim_outgov_audit)(input_data or {}):
+            return []
+        result = (recall or _recall_policy_rules)()
+        if not isinstance(result, dict):
+            return []
+        rules = [r for r in (result.get("rules") or []) if isinstance(r, dict)]
+        try:
+            total = int(result.get("total") or len(rules))
+        except (TypeError, ValueError):
+            total = len(rules)
+        if total <= 0 or not rules:
+            return []
+        shown = []
+        for r in rules[:3]:
+            statement = " ".join(str(r.get("statement") or "").split())
+            if len(statement) > 100:
+                statement = statement[:97] + "..."
+            shown.append(f"{r.get('id') or '?'} ({r.get('severity') or '?'}): {statement}")
         deny_hint = (
             " For CRITICAL severity violations: stop and explain the policy conflict "
             "before writing or executing the action that would worsen it."
@@ -85,13 +164,10 @@ def _check_outgov_compliance(_input_data: dict) -> list:
             else ""
         )
         return [
-            "[Output Governance] Evaluate this turn's output against applicable conformance rules. "
-            "If the estate MCP is connected: call the `rules.recall` tool with "
-            '{"rule_type": "policy"} — the single per-turn rule source (severity-ordered, '
-            "graph-backed; add language/layer facets if the turn is scoped) — identify applicable "
-            "rules, and report any violations with rule ID, severity, and a brief explanation. "
-            "This is advisory only. "
-            "If estate or `rules.recall` is unavailable: skip silently." + deny_hint
+            f"[Output Governance] {total} policy rule(s) apply in this store; check "
+            "this session's changes against them (advisory). Top: "
+            + "; ".join(shown)
+            + f". Full list: {_OUTGOV_LIST_CMD}" + deny_hint
         ]
     except Exception:
         return []

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.59.0",
+  "version": "12.60.0",
   "type": "module",
   "description": "The skills your coding agent can't build alone: \"done\" re-checked from evidence, graph-aware search and multi-file refactor, 40 QE specialists, review panels from other models, and cross-session memory. Works in Claude Code, Codex, Antigravity, OpenCode and Pi, in CI, or in a wicked-crew job.",
   "keywords": [

package/scripts/_context_backend.py

@@ -381,13 +381,25 @@ def memory_directive_target() -> str:
     return "the wicked-garden-mem skill (store action)"
 
 
+#: garden#1333: the exact one-line memory command an agent seat can run. A seat
+#: is read-only (the mem skill refuses `store` under --readonly), so the path
+#: that works everywhere is a pending memory proposal an operator approves.
+MEMORY_PROPOSE_COMMAND = (
+    "wicked-garden run scripts/mem/estate_memory.py --readonly propose "
+    "'<the rule, why it holds, when it applies>'"
+)
+
+
 def grounding_directive_lines() -> List[str]:
     """Numbered grounding steps for the Context Assembly directive."""
+    # No estate MCP is registered on a seat (by design): every pointer here is
+    # a skill or the read-only shim, never an MCP tool name (garden#1333).
     return [
-        "1. Ground in the knowledge layer via the wicked-garden-mem skill "
-        "(recall/answer over wicked-estate knowledge + memory) — concepts, "
-        "files, and past decisions, with source attribution; use the estate "
-        "MCP SearchEntity tool for symbol lookup.",
+        "1. Recall what is already known: the wicked-garden-mem skill "
+        "(`recall` / `answer`) for past decisions, the wicked-garden-search "
+        "skill for symbols and blast radius (or the read-only shim: "
+        "`wicked-garden run scripts/_estate_client.py --readonly search "
+        "'{\"name\":\"<symbol>\"}'`).",
         "2. Open the cited sources with Read before answering; do not answer "
         "from recall snippets alone.",
     ]

package/scripts/_estate_client.py

@@ -1366,6 +1366,32 @@ _USAGE = (
 )
 
 
+def _propose_arg_problems(args: dict) -> list:
+    """Every field `propose` is missing or has the wrong type, named exactly.
+
+    garden#1333: one generic "requires {kind_type…}" error hid which field was
+    wrong (and was also what `-` produced before stdin was read).
+    """
+    if set(args) == {"_"}:
+        return ["json-args is not valid JSON (pass one JSON object, or `-` and pipe it on stdin)"]
+    problems = []
+    kind_type = args.get("kind_type")
+    if not isinstance(kind_type, str) or not kind_type.strip():
+        problems.append("missing kind_type" if kind_type is None
+                        else "kind_type must be a non-empty string")
+    payload = args.get("payload")
+    if payload is None:
+        problems.append("missing payload")
+    elif not isinstance(payload, dict):
+        problems.append(f"payload must be an object, got {type(payload).__name__}")
+    facets = args.get("facets")
+    if facets is not None and not isinstance(facets, dict):
+        problems.append(f"facets must be an object, got {type(facets).__name__}")
+    # A missing facets.project is named by propose() itself ({"ok": false,
+    # "code": -32602, "reason": "proposal needs facets.project …"}).
+    return problems
+
+
 def _emit(obj: Any) -> None:
     # A relayed call that came back empty says why (the broker's reason and remedy), additively:
     # the fail-open empty value is unchanged.
@@ -1398,11 +1424,19 @@ def main(argv: list) -> int:
         _emit({"ok": False, "reason": refusal, "governed": True})
         return 0
     raw = argv[1] if len(argv) > 1 else "{}"
+    if raw == "-":
+        # `-` reads the json-args from stdin (garden#1333: long or quote-heavy
+        # JSON never fights shell quoting). It used to be parsed as the literal
+        # string "-", so `propose -` failed with a misleading shape error.
+        raw = sys.stdin.read()
     try:
-        args = json.loads(raw) if raw else {}
+        args = json.loads(raw) if raw.strip() else {}
     except json.JSONDecodeError:
         # Convenience: a bare positional is treated as the primary string arg.
         args = {"_": raw}
+    if not isinstance(args, dict):
+        _emit({"error": f"json-args must be a JSON object, got {type(args).__name__}; {_USAGE}"})
+        return 1
 
     if action == "health":
         _emit({"reachable": health()})
@@ -1440,12 +1474,16 @@ def main(argv: list) -> int:
         _emit({"result": blocks["result"] if blocks else None,
                "diagnostics": blocks["diagnostics"] if blocks else []})
     elif action == "propose":
-        kind_type = args.get("kind_type")
-        payload = args.get("payload")
-        if not isinstance(kind_type, str) or not kind_type or not isinstance(payload, dict):
-            _emit({"error": 'propose requires {"kind_type": "memory"|"policy:<type>", '
-                            '"payload": {...}, "facets": {...}?} — never "provenance"'})
+        problems = _propose_arg_problems(args)
+        if problems:
+            _emit({"error": "propose: " + "; ".join(problems) + ' (shape: {"kind_type": '
+                            '"memory"|"knowledge"|"policy:<type>", "payload": {...}, '
+                            '"facets": {"project": "<name>", ...}} — never "provenance"; '
+                            "for a plain memory use `wicked-garden run scripts/mem/"
+                            "estate_memory.py --readonly propose '<text>'`)"})
             return 1
+        kind_type = args["kind_type"]
+        payload = args["payload"]
         # `provenance` is deliberately not forwarded (server-stamped from WICKED_RUN_*).
         _emit(propose(kind_type, payload, args.get("facets")))
     else:

package/scripts/_session.py

@@ -154,6 +154,11 @@ class SessionState:
     # One-per-session gate for jam suggestion (reset each session).
     jam_hint_shown: bool = False
 
+    # The persisted classification prompt_submit last echoed (garden#1333):
+    # "<classified_at>|<archetypes json>". The model's own classification is
+    # echoed back once, not on every turn.
+    archetype_echoed: str | None = None
+
     # Operational log verbosity level for this session.
     # "" means "not set" — the logger defaults to "normal".
     # Valid values: "normal", "verbose", "debug"

package/scripts/mem/estate_memory.py

@@ -76,6 +76,7 @@ Usage
 -----
   python3 scripts/mem/estate_memory.py [--readonly] [--governed] [--db <path>] <action> '<json-args>'
   printf '%s' '<json-args>' | python3 scripts/mem/estate_memory.py <action> -
+  python3 scripts/mem/estate_memory.py --readonly propose '<memory text>'   # garden#1333
 """
 
 import json
@@ -106,7 +107,7 @@ KIND_DEFAULT_TIER = {
 
 _USAGE = (
     "usage: estate_memory.py [--readonly] [--governed] [--db <path>] "
-    "<store|recall|review|forget|maintain|capture-batch|ingest|write|sources|health> "
+    "<store|propose|recall|review|forget|maintain|capture-batch|ingest|write|sources|health> "
     "['<json-args>' | -]"
 )
 
@@ -134,12 +135,19 @@ def _default_intent():
     from the enclosing git checkout: ``repo`` = its directory name, ``project``
     = the run's `WICKED_RUN_PROJECT`, else the checkout's parent directory
     (the umbrella, e.g. ``wicked`` for ``wicked/wicked-estate``). Outside a git
-    checkout: {} (unfaceted memories only, as before).
+    checkout: ``{project}`` = the run's project, else the cwd's directory name,
+    the same facet `propose` files a memory under there (garden#1333), so a
+    memory proposed from a directory is recalled from it.
     """
+    run_project = (os.environ.get("WICKED_RUN_PROJECT") or "").strip()
     root = _estate_client.checkout_root()
     if root is None:
-        return {}
-    project = (os.environ.get("WICKED_RUN_PROJECT") or "").strip() or root.parent.name
+        try:
+            project = run_project or Path.cwd().name
+        except OSError:
+            project = run_project
+        return {"project": project} if project else {}
+    project = run_project or root.parent.name
     return {k: v for k, v in (("repo", root.name), ("project", project)) if v}
 
 
@@ -301,6 +309,66 @@ def do_store(args):
     return 0
 
 
+def _propose_facets():
+    """``facets`` for a memory proposal: exactly the intent default recall
+    admits against (:func:`_default_intent`), so the approved memory is
+    recalled from the same place. ``project`` falls back to ``unknown`` only
+    when the cwd has no name."""
+    facets = dict(_default_intent())
+    facets.setdefault("project", "unknown")
+    # The same override the shim applies, so the reported facets are the sent ones.
+    return _estate_client._scope_facets_to_run_project(facets)
+
+
+def do_propose(args):
+    """garden#1333 — the one-line memory path for an agent seat.
+
+    ``propose '<text>'`` (or ``propose -`` with the text or a JSON object on
+    stdin) builds the whole ``proposal.submit`` envelope itself: ``kind_type:
+    memory``, ``payload {content, tier}``, ``facets.project`` (+ ``repo``) from
+    the cwd. It is the write a ``--readonly`` seat still has: the memory lands
+    ``pending`` until an operator approves it. JSON args may set ``content``
+    (or ``text``), ``kind`` (fact → semantic, skill → procedural), ``tier``,
+    ``about`` and ``facets`` (merged over the derived ones).
+    """
+    content = args.get("content") or args.get("text") or args.get("_") or ""
+    if not isinstance(content, str):
+        return _fail_open(f"content must be a string, got {type(content).__name__}")
+    content = content.strip()
+    if not content:
+        return _fail_open('nothing to propose: pass the memory text, e.g. propose '
+                          '"<rule, why it holds, when it applies>"')
+    if args.get("source"):
+        return _fail_open("acquired from a source, so it is knowledge, not memory: use the "
+                          "`write` action or a knowledge proposal")
+    rejects = durability_rejects(content)
+    if rejects:
+        return _fail_open("not a durable learning (" + "; ".join(rejects) + "): state the rule, "
+                          "why it holds and when it applies")
+    kind = args.get("kind") or "fact"
+    if kind not in KINDS:
+        return _fail_open(f"unknown kind: {kind} (valid: {', '.join(KINDS)})")
+    tier = args.get("tier") or KIND_DEFAULT_TIER[kind]
+    if tier not in TIERS:
+        return _fail_open(f"unknown tier: {tier} (valid: {', '.join(TIERS)})")
+    payload = {"content": content, "tier": tier}
+    about = args.get("about")
+    if isinstance(about, list) and about:
+        payload["about"] = [str(a) for a in about]
+    facets = _propose_facets()
+    extra = args.get("facets")
+    if isinstance(extra, dict):
+        facets.update({k: v for k, v in extra.items() if isinstance(v, str) and v.strip()})
+    out = _estate_client.propose("memory", payload, facets)
+    if out.get("ok"):
+        out["facets"] = facets
+        warnings = durability_warnings(content)
+        if warnings:
+            out["warnings"] = warnings
+    _emit(out)
+    return 0
+
+
 def do_recall(args):
     query = (args.get("query") or args.get("_") or "").strip()
     if not query:
@@ -497,6 +565,7 @@ def do_health(_args):
 
 _ACTIONS = {
     "store": do_store,
+    "propose": do_propose,
     "recall": do_recall,
     "review": do_review,
     "forget": do_forget,
@@ -529,6 +598,8 @@ def main(argv):
         raw = sys.stdin.read()
     try:
         args = json.loads(raw) if raw.strip() else {}
+        if args is None or isinstance(args, (str, int, float, bool)):
+            args = {"_": raw.strip()}  # a JSON scalar is the primary string arg too
     except json.JSONDecodeError:
         # Convenience: a bare positional is the primary string arg.
         args = {"_": raw}

package/skills/classify/SKILL.md

@@ -7,9 +7,9 @@ description: |
   reversibility, etc.), and persists to SessionState so subsequent turns
   steer correctly.
 
-  Use when: the prompt_submit hook emitted a `<wg classify-due />` directive,
-  OR explicitly invoked at session start, OR when re-classifying after the
-  user changes scope mid-session.
+  Use when: explicitly invoked at session start, when the work shape is
+  unclear and matters, OR when re-classifying after the user changes scope
+  mid-session.
 metadata:
   role: worker
 ---
@@ -49,8 +49,11 @@ When a routing or decision call is genuinely hard, ambiguous, or high-stakes,
 garden tools for additional processing. The council is the *escalation*, not a
 per-prompt router — convening 20 CLIs on every prompt would be absurd cost.
 
-- **Fast path (always on)** — the `prompt_submit` hook emits `<wg classify-due />`,
-  you classify + persist here, the parent turn steers on the persisted archetype.
+- **Fast path (on demand)** — you invoke this skill when the work shape matters,
+  classify + persist here, and the parent turn steers on the persisted archetype.
+  (The `prompt_submit` hook no longer emits `<wg classify-due />` when its regex
+  falls through: that nag fired on ordinary questions, garden#1333. It stays
+  silent unless the regex is confident.)
 - **Escalation (on demand)** — `wicked-garden-jam council <question> --options "…"`.
 
 ## What the catalog declares

package/skills/mem/SKILL.md

@@ -50,8 +50,9 @@ A human operator at a terminal may omit it to `store` / `ingest` / `forget`. The
 read-only with the store pinned from
 the environment (`WICKED_ESTATE_DB` / `WICKED_HOME` / `WICKED_MEMORY_DB`) or `--db <path>`; an
 unpinned store is refused (`ok: false`), and `store` / `capture-batch` / `ingest` / `write` /
-`forget` are refused by the read-only engine — capture learnings as proposals instead (the
-`wicked-garden-repo-learn` skill's capture contract). `recall` / `review` / `sources` / `health`
+`forget` are refused by the read-only engine — save a learning with `propose` instead
+(§ Propose: one line, the backend builds the proposal), or file knowledge/policy proposals
+through the `wicked-garden-repo-learn` skill's capture contract. `recall` / `review` / `sources` / `health`
 work unchanged. Spell `--readonly` exactly (`--read-only` is a usage error). This is the one way
 to the stores on every seat and in every session kind: no estate tool is registered on a seat,
 nothing to connect, nothing to fall back to.
@@ -66,6 +67,7 @@ Relative paths in this skill are relative to the directory that contains this SK
 | Action | Use for | How |
 |--------|---------|-----|
 | `store` | persist one learning (decision, pattern, gotcha, discovery) | § Store |
+| `propose` | save one learning from a read-only seat (lands pending for operator approval) | § Propose |
 | `recall` | find memories ("what do we know about X") | § Recall |
 | `answer` | grounded, cited answer from the stores | the `wicked-garden-search` skill's `refs/answer.md` |
 | `review` | browse what's stored (counts by kind/tier, scope digest) | § Review / Maintain |
@@ -111,6 +113,22 @@ A chat seat asked by wicked-crew to label the operator's decisions reads
 4. Confirm the returned `memory_id`; on `ok: false` report the degrade — do
    not silently drop the learning.
 
+## Propose — the one-line memory path on a seat
+
+A seat is read-only, so `store` is refused there. `propose` is the write it still has:
+
+```bash
+wicked-garden run scripts/mem/estate_memory.py --readonly propose '<the rule, why it holds, when it applies>'
+printf '%s' '<long text>' | wicked-garden run scripts/mem/estate_memory.py --readonly propose -
+```
+
+The backend builds the whole proposal: `kind_type: "memory"`, `payload {content, tier}`
+(`fact` → `semantic`; pass `{"content": …, "kind": "skill"}` for a how-to → `procedural`),
+and `facets` `{repo, project}` from the cwd's checkout (`project` = the cwd name outside one;
+a run's `WICKED_RUN_PROJECT` wins). The § Store durability test applies and the backend
+enforces the same refusals. It answers `{"ok": true, "id": …, "facets": …}`; the memory is
+`pending` until an operator approves it. On `ok: false`, report the reason.
+
 ## Recall
 
 ```bash

package/skills/repo-learn/refs/capture-proposals.md

@@ -47,7 +47,9 @@ which files it under the run's project. With neither, a run refuses it with `{"o
 "reason": …}` — report it, do not guess a store. The shim answers `{"ok": true, "id": "<proposal-id>"}` or `{"ok": false,
 "reason": …, "code": <json-rpc code or null>}`: `-32602` is a *your-args* bug (fix the
 shape), `null` means the estate was unreachable (keep the objects — next section). Pass
-the JSON as ONE quoted argument, even when it is long: `propose` does not read stdin. A
+the JSON as ONE quoted argument, or pass `-` and pipe it on stdin (`printf '%s' '<json>' |
+… propose -`). A plain memory needs no envelope at all: `wicked-garden run
+scripts/mem/estate_memory.py --readonly propose '<text>'` builds it. A
 `provenance` key is dropped.
 
 ### When `propose` fails in a governed run — no file fallback